Detecting two-party quantum correlations in quantum key distribution protocols 
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A necessary precondition for secure quantum key distribution (QKD) is that sender and receiver 
can prove the presence of entanglement in a quantum state that is effectively distributed between 
them. In order to deliver this entanglement proof one can use the class of entanglement witness 
(EW) operators that can be constructed from the available measurements results. This class of EWs 
can be used to provide a necessary and sufficient condition for the existence of quantum correlations 
even when a quantum state cannot be completely reconstructed. The set of optimal EWs for two 
well-known entanglement based (EB) schemes, the 6-state and the 4-state EB protocols, has been 
obtained recently [M. Curty et al., Phys. Rev. Lett. 92, 217903 (2004)]. Here we complete these 
results, now showing specifically the analysis for the case of prepare&measure (P&M) schemes. For 
this, we investigate the signal states and detection methods of the 4-state and the 2-state P&M 
schemes. For each of these protocols we obtain a reduced set of EWs. More importantly, each set of 
EWs can be used to derive a necessary and sufficient condition to prove that quantum correlations 
are present in these protocols. 
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I. INTRODUCTION 



One of the most important problems in modern cryp- 
tography is the transmission of secret information from a 
sender (usually called Alice) to a receiver (Bob) over an 
insecure communication channel pj . The goal is to guar- 
antee that any possible eavesdropper (Eve), with access 
to the channel, is unable to obtain useful information 
about the message. 

Secret systems were studied from an information- 
theoretic perspective by C. E. Shannon Q. He analyzed 
the natural scenario where Eve has always access to ex- 
actly the same information received by Bob. This infor- 
mation, denoted as C (from the term ciphertext), is typ- 
ically obtained by Alice as a function of the message to 
be sent, M, and a secret key, K, that she needs to share 
previously with Bob. In this context, Shannon defined a 
cryptographic system to be perfectly-secret and uniquely 
decodable if it satisfies the following two conditions: first, 
the ciphertext, C, and the message, M, must be statis- 
tically independent. This means that Eve cannot obtain 
any useful information about the message M from C. 
This condition can be expressed as I(M; C) = 0, where I 
denotes the mutual information measured in bits . The 
second condition states that Bob can recover the origi- 
nal message M from C and K. It can be formulated as 
H (M\C, K) = 0, with H the Shannon entropy measured 
also in bits • With this definition, Shannon proved the 
well-known pessimistic result that every perfectly-secret 
uniquely decodable system must satisfy H(K) > H(M). 
An example of a secret cryptographic system satisfying 
this condition is the so-called one-time-pad or Vernam 
cipher 



The result from Shannon relies in a fundamental way 
on considering that both Bob and Eve have perfect ac- 
cess to the same ciphertext C . However, there are scenar- 
ios, such is the case in quantum key distribution (QKD), 
where the proper exploitation of particular quantum ef- 
fects can prevent Bob and Eve to receive precisely the 
same information. The laws of Quantum Mechanics can 
guarantee some minimal uncertainty between both sig- 
nals, and this fact can be used by Alice and Bob to 
expand a previously shared secret key K in an uncon- 
ditionally secure manner 0, 0, IE 0- This means that 
QKD together with the Vernam cipher can in principle 
be used to achieve perfectly secret communications even 
when H(K) < H(M). 

In any realization of QKD one can typically distinguish 
two phases in order to expand a secret key. In the first 
phase, an effective bi-partite quantum mechanical state 
is distributed between Alice and Bob. This state creates 
correlations between them and it might contain as well 
hidden correlations with Eve. Next, a (restricted) set of 
measurements is used by the legitimate users to measure 
these correlations. As a result, Alice and Bob obtain 
a classical joint probability distribution P(A, B) repre- 
senting the measurement results. In the second phase, 
usually called key distillation, Alice and Bob use an au- 
thenticated public channel to process the correlated data 
in order to obtain a secret key. This procedure involves, 
typically, postselection of data, error correction to recon- 
cile the data, and privacy amplification to decouple the 
data from Eve @. 

Two types of schemes are used to create the correlated 
data in the first phase of QKD. In entanglement based 
(EB) schemes an, in general, untrusted third party dis- 
tributes a bi-partite state to Alice and Bob. This party 
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may be even Eve who is in possession of a third sub- 
system that may be entangled with those given to Alice 
and Bob. While the subsystems measured by Alice and 
Bob result in correlations described by P(A, B), Eve can 
use her subsystem to obtain information about the data 
of the legitimate users. 

In prepare&measure (P&M) schemes Alice prepares a 
random sequence of pre-defined non-orthogonal states 
\ifi) that are sent to Bob through an untrusted quan- 
tum channel (possibly controlled by Eve). On the receiv- 
ing side, Bob performs a positive operator value measure 
(POVM) on every signal he receives. Generalizing the 
ideas introduced by Bennett et al. [jj, the signal prepa- 
ration process in P&M schemes can be thought of as fol- 
lows: Alice prepares an entangled bi-partite state of the 
form |\E')as = J2i \/Pi\ a i) where the states form 
an orthonormal basis and {pi}i represents the a priori 
probability distribution of the signal states \ f If now 
Alice measures the first system in the basis \cti), she ef- 
fectively prepares the (non-orthogonal) signal states \<fii) 
with probabilities pi. The action of the quantum chan- 
nel on the state ab leads to an effective bi-partite 
quantum state shared by Alice and Bob. One impor- 
tant difference between P&M schemes with effective en- 
tanglement and EB schemes with real entanglement is 
that in the first case the reduced density matrix of Alice, 
Pa = Trg(\^f) (^\ab)i is fixed and known and cannot be 
modified by Eve. 

An essential question in QKD now is whether the corre- 
lated data generated in the first phase enable Alice and 
Bob to extract a secret key. In Ref. 0] it has been 
proven that a necessary precondition for secure key dis- 
tillation is the provable presence of quantum correlations 
in P(A,B). That is, it must be possible to interprete 
P(A, B), together with the knowledge of the correspond- 
ing measurements, as coming exclusively from an entan- 
gled state. Moreover, this result applies both for EB 
and P&M schemes (For EB schemes see also 0). Ali ce 
and Bob need to be able to detect the presence of en- 
tanglement in the quantum state that is effectively dis- 
tributed between them, otherwise no secret key can be 
obtained. Among all separability criteria available nowa- 
days to deliver this entanglement proof (see, e.g., 
and references therein), entanglement witnesses (EWs) 
0, 0, 0] are particularly suited for this purpose since 
they give rise to a necessary and sufficient condition for 
the existence of quantum correlations in P(A,B), even 
when the state shared by Alice and Bob cannot be com- 
pletely reconstructed I n R- e f- El a detailed analy- 
sis of two well-known EB protocols, the 6-state and the 
4-state EB protocols 0, El j is included and the set of 
optimal EWs to detect quantum correlations in both pro- 
tocols has been found. The purpose of this paper is to 
complete the results contained in Ref. 0], now showing 
specifically the analysis for the case of P&M schemes. In 
particular, we investigate the signal states and detection 
methods of the 4-state and the 2-state P&M schemes 
@, 0|, and we obtain a reduced set of EWs that can 



be used to derive a necessary and sufficient condition to 
prove that quantum correlations are present in these pro- 
tocols. As a side point, we put into context recent results 
that can be useful in the search of quantum correlations 
for higher dimensional QKD schemes |l7l |. 

The paper is organized as follows. In Section [n] we 
review the role of quantum correlations as precondition 
for secure QKD. Section II I II introduces the concept of 
EWs and shows how to detect quantum correlations by 
using the class of EW operators that can be constructed 
from the available data. This formalism is then used in 
Section IIVI to analyze well-known QKD protocols. Our 
starting point are the EB schemes studied in Ref. [Toj : 
The 6-state and 4-state EB schemes. Then we present 
the new results for P&M schemes, analyzing in detail the 
4-state and the 2-state P&M schemes. The last part of 
the section gives a brief outlook to the study of quantum 
correlations in higher dimcnsionsal QKD schemes and in 
practical QKD. Finally, Section Ivl concludes the paper 
with a summary. 



II. QUANTUM CORRELATIONS & QUANTUM 
KEY DISTRIBUTION 

As mentioned in the introduction, the provable pres- 
ence of quantum correlations in P{A 1 B) has been shown 
to be a necessary precondition for secure QKD 0] . The 
starting point for such a proof is an upper bound for 
the distillation rate of a secure key from correlated data 
via authenticated public communication, which is given 
by the intrinsic information I(A;B J. E), introduced 
by Maurer and Wolf These authors considered the 
problem of key distillation in the classical scenario where 
Alice, Bob, and Eve have access to repeated indepen- 
dent realizations of three random variables, denoted as 
A, B, and E, characterized by a probability distribution 
P(A, B, E). In this context, Maurer and Wolf proved 
that the rate of secret bits, denoted as S(A;B\\E), that 
Alice and Bob can get by communicating to each other 
through a public authenticated channel satisfies : 



S{A-B\\E)<I{A-B[E) 



min I(A;B\E), (1) 

E—tE 



where the minimization runs over all possible channels 
E — > E characterized by the conditional probability 
P(E\E), and I(A;B\E) is the mutual information be- 
tween Alice and Bob given the public announcement of 
Eve's data based on the probabilities P(A, B, E). This 
quantity is defined in terms of the conditional Shannon 
entropy H(X\e) = J2 X &X -p{x\e)\og 2 p(x\e) as 



I(A; B\E) = J2 P(e) \H(A\e) + H(B\e) - H(A, B\e) 

e£E 

(2) 

More important for QKD, the result of Maurer and 
Wolf can as well be adapted to the case where Alice, Bob 
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and Eve start sharing a tri-partitc quantum state instead 
of a joint probability distribution. For this purpose, one 
can consider all possible tri-partite states that Eve can 
establish using her eavesdropping method, and all possi- 
ble measurements she could perform on her sub-system. 
This gives rise to a set of possible extensions V of the ob- 
servable probability distribution P(A,B) to P(A,B,E). 
Now one can define the intrinsic information as 

I(A;B lE)=mi v I{A;B\E) . (3) 

The main consequence of this fact is that whenever the 
observable data P(A, B) can be explained as coming from 
a tri-partite state with a separable reduced density ma- 
trix for Alice and Bob, the intrinsic information vanishes 
and therefore no secret key can be established. 

Observation 1 TTA l Assume that the observable joint 
probability distribution P(A, B) together with the knowl- 
edge of the corresponding measurements performed by Al- 
ice and Bob can be interpreted as coming from a separable 
state o~ab- Then the intrinsic information vanishes and 
no secret key can be distilled via public communication 
from the correlated data. 

Proof: This is easy to see for EB schemes as we 
extend a separable reduced density matrix oab — 
J2i Q-i \4>i)a{4>i I <£> \ipi)B(tpi\ to a tri-partite pure state of 
the form \$)abe = y/Oil^A^Ble^E- (See also 
[ll|.) Here \ei)E is a set of orthonormal vectors span- 
ning a Hilbcrt space of sufficient dimension. If Eve mea- 
sures her sub-system in the corresponding basis, the con- 
ditional probability distribution conditioned on her mea- 
surement result factorizes such that for this measurement 
I(A;B\E) = 0. As a consequence, the intrinsic informa- 
tion vanishes and no secret key can be distilled. 

In the case of P&M schemes we need to show addi- 
tionally that the state \Q)abe can be obtained by Eve 
by interaction with Bob's system only. The initial state 
|^)ab = 'Ylii\fpl\ a i)\ i Pi) can be written in the Schmidt 
decomposition as I^as = X)i c il u i) A\Vi) b- Then the 
state \<&}abe from above is in the Schmidt decomposi- 
tion, with respect to system A and the composite system 
BE, of the form \$)abe = J2l c i\ u i) A\e%) be since c; 
and | Mi) a are fixed by the known reduced density ma- 
trix pa = TtbH^) (^\ab) to the corresponding values of 
Then one can find always a suitable unitary op- 
erator Ube such that \ei)BE = Ube\vi) b|0) e where \Q)e 
is an initial state of an auxiliary system. ■ 

The natural question that arises now is whether the 
presence of quantum correlations is also a sufficient con- 
dition for secure QKD. Let us mention already here that 
this is still an open question in the field of quantum cryp- 
tography. In EB schemes, it is clear that it is possible to 
obtain a secret key whenever the distributed bi-partitc 
states are entangled qubit states and each party is al- 
lowed to perform collective quantum manipulations on 
their respective states. This is true since in this situa- 
tion one can first distill maximally entangled states from 
the initial states and subsequently measure them out in 



the standard basis [19j . The verification that the entan- 
glement distillation process succeeded allows to give the 
security statement about the resulting perfectly corre- 
lated and random measurement data, which can then be 
used as a secret key. 

A completely different scenario arises once Alice and 
Bob have already performed their respective measure- 
ments on the given states and they can only use classi- 
cal operations on their correlated data. This last case 
has been partially addressed under additional assump- 
tions, namely that the eavesdropping attack employed by 
Eve is restricted to the so-called "incoherent symmetric 
strategies", in [2(j. In this situation it has been proven 
that for a particular class of QKD protocols key distil- 
lation is possible if and only if the initially distributed 
states are distillable [2jj. In the same spirit, Acin et al. 
|2l| showed that one can always distill a secret key from 
any two-qubit and one-copy distillable states by adapt- 
ing the local measurements to the quantum states and 
performing subsequently a classical protocol. All these 
results suggested the idea of a correspondence between 
entanglement distillation and secret key distillation. See 
also [22j . The main conjecture was that a quantum state 
could lead to a secret key if and only if it is distillable, 
which is not equivalent to containing quantum correla- 
tions J23|. However, this point of view changed recently, 
since it has been shown that it is also possible to gener- 
ate a secret key even from certain non-distillable entan- 
gled states, known as bound entangled or positive partial 
transposed (PPT) entangled states |24| ■ These are states 
that require entanglement to be created but do not al- 
low to distill entanglement from them j2^|. This shows 
that the focus on entanglement distillation guided proto- 
cols in QKD is too narrow, though the interesting exam- 
ple introduced in Ref. |24j does not answer the question 
whether all entangled states can be transformed into a 
private key. 

More recently, going back to the quantum correlations 
point of view, Acm and Gisin |25j | proved that it is an 
equivalent statement to show that there has been (real 
or effective) entanglement in the distributed quantum 
state and that the intrinsic information is non-zero. In 
particular, this result implies that there exist a one-to- 
one relation between the detection of entanglement in 
P(A, B) and the fact that such probability distribution 
cannot be obtained by classical means using only local 
operations and classical communication |25ll26| |. That is, 
P(A, B) contains secret bits. More important for QKD, 
this means that either it is possible to distill a secret 
key from any bi-partitc entangled state or there exits 
a classical analog of bound entanglement, the so-called 
bound information |27j . This is information shared by 
Alice, Bob and Eve such as Alice and Bob cannot obtain 
a secret key from it although this information cannot be 
distributed by local operations and classical communica- 
tion. However, so far the existence of bound information 
has been proven for the multi-partite case [2^] (for the 
case of coherent manipulations of multi-party quantum 
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states see also |23), but not for the bi-partite case rele- 
vant for QKD. 

III. DETECTING QUANTUM CORRELATIONS 

Given that quantum correlations are necessary for dis- 
tilling a secure secret key, the question now is how to de- 
tect these quantum correlations in a given QKD scheme. 
More precisely, we have to answer the question whether 
the joint probability distribution P(A, B), coming from 
the measurements performed by Alice and Bob during 
the protocol, allow them to conclude that the effectively 
distributed state was entangled or not. In principle any 
separability criteria (see, e.g., 01 an d references therein) 
might be employed to deliver this entanglement proof. 
The important question here is whether the chosen crite- 
rion can can be used to provide a necessary and sufficient 
condition to detect entanglement when the knowledge 
about the state is not tomographic complete. As we will 
see below, it is a property of EWs that they allow to ob- 
tain a necessary and sufficient criterion for separability 
even when the state cannot be completely reconstructed 

Let us first consider EB schemes. In these schemes, 
Alice and Bob perform some measurements on a bi- 
partite quantum state distributed by an, in general, un- 
trusted third party and retrieve the probability distribu- 
tion P(A, B) of the outcomes. Before showing that in 
this scenario EWs are specially appropriated to detect 
ent angl ement, let us recall some facts about witnesses 

A witness is a Hcrmitcan observable W with a positive 
expectation value on all separable states. So if a state p 
obeys Tr(pW) < 0, the state p must be entangled. We 
say then that the state p is detected by W. In general, 
for every entangled state there exists a witness detecting 
it, however, this witness is in most cases very difficult to 
construct. Witnesses can be optimized in the following 
sense: A witness W\ is called finer than another witness 
W-2 if W\ detects all the states which are detected by 
W2 and some states in addition. Finally, a witness W is 
called optimal, when there is no other witness which is 
finer than W flEI ]. Now we can state the following (see 
also [13): 

Theorem 1 Assume that Alice and Bob can perform 
some local measurements with POVM elements Ai® Bi, 
i = l,...,n, to obtain the probability distribution of the 
outcomes P(A, B) on the distributed state p. Then the 
correlations P{A, B) cannot originate from a separable 
state if and only if there is an EW of the form W = 
Y]- Ci Ai £g> Bi which detects the effectively distributed 
state, i.e., Tr(Wp) = YV a P(A 4 ,B 4 ) < 0. 

Proof: One direction of the above theorem is clear: If 
such a witness with the properties from above exists, then 
the effectively distributed state is clearly entangled. To 
prove the other direction, let us look at the the following 



map, which maps a quantum state p to a real vector 

2l(p) e R", 

21: p^2t(p) = {2t(p)o,...,2t(p)„}, (4) 

where 2l(p), = P(A t ,5. t ) = Tr{A t <g> B t p). That is, 
it maps a state onto the set of probabilities or expecta- 
tion values of the POVM elements. This map is linear 
and, in general, not injective. It maps the convex set 
S of separable states onto the convex set S' := 21(5*). 
An entangled state p with the property 2t(p) G S' can- 
not be detected with the given probabilities, since then 
there is a separable state p s being mapped to the same 
2l(p s ) = 2l(/o), thus p and p s arc indistinguishable. So a 
state p e for which P(A, B) cannot origin from a separable 
state must obey 2l(p e ) 4- S' ■> Now we have the usual con- 
struction of witnesses: There must exist a hyper-plane 
separating 2l(p e ) from S'. This means that there is a 
vector w = (wx, w n ) with JV w i 2t(f?e)j < while 
Wi %{q) 1 > for all p with %(p) G S'. The observ- 
able W = J^i w i Ai <S> Bi is now the desired EW, since 
Tr(Wp) = ^2 i w i P(Ai,Bi). M 

We refer to witnesses that can be evaluated with the 
given POVM elements and the corresponding correla- 
tions P(A, B) as accessible. According to Theorem^ the 
set of all accessible witness operators gives rise to a neces- 
sary and sufficient condition for verifiable entanglement 
contained in the correlations P(A,B): The joint prob- 
ability distribution P(A, B) can come exclusively from 
an entangled state if and only if at least one accesible 
witness in the set gives rise to a negative expectation 
value when it is evaluated with P(A, B). Of course, in 
this set there is some redundancy. Typically, it contains 
witnesses that are finer than others, and therefore one 
can construct smaller sets of witnesses that are accessible 
and still have the property of being necessary and suffi- 
cient for verifying entanglement. Whenever this prop- 
erty holds, we refer to a set of witnesses VV as being 
a verification set. The ultimate goal will be to obtain 
a minimal verification set in a compact description that 
contains no further redundancies to allow an efficient sys- 
tematic search for verifiable entanglement by evaluating 
the members of this set. The rest of this paper is mainly 
concerned with the search of these minimal verification 
sets, although in the case of the 4-state P&M protocol 
and in the 2-state P&M protocol we find only reduced 
verification sets, which still may contain some redundan- 
cies. 

Before starting our quest for minimal verification sets, 
let us consider the case of P&M schemes since in this sec- 
tion we have considered, so far, only EB schemes. As wc 
mentioned previously, in this kind of schemes the reduced 
density matrix of Alice is fixed since Eve has no access 
to the state of Alice to try to modify it. However also 
this situation can be incorporated in the theorem from 
above: We can add to the observables Ai <g> Bi other 
observables C, <g) 1 such that the observables Ci form a 
tomographic complete set of Alice's Hilbert space. Those 
witnesses that can be evaluated with this combined set of 
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measurements can clearly be evaluated with the measure- 
ments Ai ® Bi and the knowledge of the reduced density 
matrix of Alice. 

In the geometric picture obtained in the proof of the 
theorem from above, the knowledge of the expectation 
value of some of the observables implies that we know 
that our state lies on some hyperplane in the space of 
all expectation values. Then, we want to decide for a 
point on this hyperplane whether is is in S' or not, and 
this can be done by witnesses. The knowledge of the 
mean values of some observables may be used to argue 
that only a smaller set of witnesses is relevant for such a 
P&M scheme. We will see an example of this later. 

Finally, let us emphasize again that there are many 
other separability criteria besides EWs which might be 
used for the detection of entanglement in quantum cryp- 
tographic schemes. For instance, the security of the first 
EB scheme proposed by Ekert in 1991 Q, the 4-state EB 
scheme, was based on the detection of quantum correla- 
tions by looking at possible violations of Bell inequalities 
|3fij . This criterion, or for example those based on un- 
certainty relations [3jJ], is directly linked to experimen- 
tal data, which makes the implementation simple. An- 
other interesting criterion that seems to be particularly 
suited for the case of P&M schemes, where the reduced 
density matrix of Alice is fixed and known, is, for in- 
stance, the reduction criterion |32T |. However, it is not 
clear whether these criteria guarantee to detect all en- 
tangled states which can be detected with the given set 
of measurements. In fact, in the case of the 4-state, the 
knowledge of the performed measurements together with 
P(A, B) allows to detect entangled states beyond those 
that violates Bell-like inequalities. 



IV. QKD PROTOCOLS 

We will now illustrate the consequences of this view 
for some well-known QKD protocols. First we start re- 
viewing the recent results obtained in Ref. 01 f° r the 
6-state and the 4-state EB protocols 0, Q , which include 
a minimal verification set to detect quantum correlations 
in both protocols. Then we present the analysis for the 
case of P&M schemes. We investigate the 4-state and 
the 2-state P&M schemes 0, and we obtain a re- 
duced verification set for each of these protocols. Fi- 
nally, the last part of the section gives a brief outlook to 
the study of quantum correlations in higher dimensional 
QKD schemes and in practical QKD 17]. 



A. 6-state protocol 

For the case of the 6-state EB protocol, Alice and Bob 
perform projection measurements onto the eigenvectors 
of the three Pauli operators a x ,a y , and cr z on the bi- 
partite qubit states distributed by Eve. In the corre- 
sponding P&M scheme Alice prepares the eigenvectors of 



those operators by performing the same measurements on 
a maximally entangled two-qubit state. Note that here 
we are not using the general approach introduced previ- 
oulsy, \^>}ab = \/Pi\<y-i)\ l Pi) , to model P&M schemes, 
since for this protocol it is sufficient to consider that the 
effectively distributed quantum state consists only of two 
qubits. In both cases Alice has complete tomographic 
knowledge of her subsystem and therefore the class of 
EWs, which can be constructed in both protocols, coin- 
cide. The set of three measurement bases used in the 
protocol allows Alice and Bob to construct any EW of 
the form 

W = ^ <kj <?i ® 0j, (5) 

i,j={0,x,y,z} 

where <to = 1 and are real numbers. Note that the set 
of operators {at (g> <Tj}i,j constitutes an operator basis in 
C 2 Cg>C 2 . This means that Alice and Bob can in principle 
evaluate all EWs, in particular, the class of optimal wit- 
nesses for two-qubit states. This class, denoted by OEW, 
is given by the witnesses operators of the form \X\ 

W= |4>e><0ef P J (6) 

where \<f> e ) denotes any entangled state of two-qubit sys- 
tems and Tp is the partial transposition, that is, the 
transposition with respect to one of the subsystems |34j . 
Therefore, in the 6-state protocol, both for EB and P&M 
schemes, all entangled states can be detected and the op- 
timal witnesses OEW form the minimal verification set. 

Alternatively to the witness approach, Alice and Bob 
can employ as well quantum state tomography techniques 
to reconstruct the effectively distributed quantum state 
and then use the Peres-Horodecki criterion 0, |3f| to de- 
termine whether that state was entangled or not. This 
criterion establishes that a two-qubit state is separable 
iff its partial transposition is positive. For higher di- 
mensional systems, however, note that although all op- 
erators with non-positive partial transposition are entan- 
gled, there exist PPT entangled states [23j | . 

B. 4-state protocol 

While the analysis of the 6-state protocol is quite sim- 
ple, due to the complete tomographic information that 
Alice and Bob share, the 4-state protocol needs a deeper 
examination. As we will show below, the class of OEW 
for two-qubit systems cannot be evaluated with the given 
correlations neither in the EB nor in the P&M versions of 
the protocol. In the EB case Alice and Bob perform pro- 
jection measurements onto two mutually unbiased bases, 
say the ones given by the eigenvectors of the two Pauli 
operators a x and a z . In the corresponding P&M scheme, 
Alice can use as well the same set of measurements but 
now on a maximally entangled state. Here again, like in 
the 6-state protocol, we use the fact that the approach 
I^as = J2i ^/PiWi^fi) to model P&M schemes can be 
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reduce to employ only two-qubit states for this protocol. 
Let's begin our analysis for the EB scheme [To| . 

1. Entanglement-based (EB) 

In the case of the 4-state EB protocol we will denote 
the set of EWs that can be evaluated with the resulting 
correlations as Wf" 5 . All elements are of the form 

Wf B = CijPi®Vj- (7) 

i,j={0,x,z} 

This class of EWs can be characterized with the following 
observation. 

Observation 2 TTA l Given an entanglement witness W 
we find W G Wf B iffW = W T = W Tp . 

Proof: To see this, we start with the general Ansatz of 
Eq. © and we impose the conditions W = W T = W Tp . 
This directly constraints W to the form Q) since a y is 
the only skew-symmetric element in the operator basis. 
The reverse direction is then trivial. I 

It is straightforward to see that the elements of OEW 
do not fulfill this condition. Below, we will provide a cri- 
terion to decide if an entangled state can be detected by 
W G W BB . This means that, in contrast to the case of 
the 6-state protocol, in the 4-state EB protocol there can 
be entangled states that give rise to correlations P(A, B) 
that are not sufficient to prove the presence of entangle- 
ment. 

The concept of optimal witnesses introduced in Section 
IIIII for general witness operators can as well be extended 
to the witnesses which are accessible with the given set 
of measurements. This way we call a witness W optimal 
in class C iff there is no other element in C that detects 
all entangled states detected by W. Our goal now is to 
characterize a complete family of witness operators that 
are optimal in the class W EB . This family forms the 
minimal verification set. Then it is sufficient to check 
this family to decide whether the presence of entangle- 
ment can be verified from the given data. To do this we 
start presenting a necessary and sufficient condition for 
a bi-partite state to contain entanglement that can be 
detected by elements of Wf B . 

Observation 3 Udl ] An entangled state p can be de- 
tected with a W G W BB iff the operator fl = 
\ (p + P Ta + p Ts + p T ) is a non-positive operator. 

Proof: To see this, let us start by the observation that 
the symmetries of the witness operators in Wf B give 
rise to the identity Ti(Wp) = Tr(WQ). Now let us 
assume that the operator f2 is non-negative. Then one 
can interpret it as a density matrix. Since it is invariant 
under partial transposition, it must be a separable state. 
Since If is a witness operator, we must therefore find 
Tr (Wp) > 0. As a result, we find that the non-positivity 
of Q is a necessary condition to detect entanglement of 



the state p with witnesses in W4 . The reverse direction 
is included here only for completeness and the proof is 
included implicitly in Theorem [3 I 

Next we present a set of EWs composed of optimal 
witnesses in the class Wf B which forms a minimal veri- 
fication set of the 4-state EB protocol. 

Theorem 2 \l(\J Consider the family of operators W = 
\{Q + Q Tp ), where Q — \<p e )((j> e \ and \cj) e ) denotes a real 
entangled state. The elements of this family are witness 
operators that are optimal in Wf B (OEW EB ) and detect 
all the entangled states that can be detected within Wf B . 

Proof: Let us start by checking that this family, in- 
deed, can detect all entanglement that can be detected 
in Wf B . From the Observation [3| we know that we 
need only to consider bi-partite states p such that Q = 
j (p + P Ta + P Tb + p T ) is non-positive. We have, there- 
fore, that there exists always an (entangled) state \</> e ) 
such that (4> e \£l\cj) e ) < 0. Moreover, since SI = S1 T , 
this operator has a real representation. In this repre- 
sentation, also the state \<f> e ) has a real representation 
[36j . Let us define the projector Q = \(f> e )(4> e \. Then 
we find (0e|O|0 e ) = Tr ( j (Q + Q Ta + Q Tb + Q T ) p) ■ 
This means that we can define the operator W = 
\{Q + Q Ta + Q Tb + Q T ) that can be further simplified 
to W = \{Q + Q Tp ) thanks to the real representa- 
tion of Q. This operator is a witness operator, since 
Tr (Wa) > for all separable states a, while Tr (Wp) < 
for the chosen p. Moreover, by construction the family 
of these witness operators detects all entanglement that 
can be detected within Wf B . 

Finally, we need to show that all witnesses of this new 
setW=\(Q + Q Tp ) are optimal within Wf B so they 
form OEW|' B . In Ref. ^3 ^ has been proven that, given 
a set of witness operators Sw, W G Sw is optimal in Sw 
iff for all positive semi-definite operators P and e > 0, 
W = (l + e)W-eP $ Sw When a P can be subtracted, 
it has to fulfill (e, f\P\e,f) = for all product vectors 
\e,f) G C 2 (g) C 2 with (e,f\W\e,f) = since otherwise 
we would not have a witness anymore. In the case of 
witness operators of the form W = |(Q + Q Tp ), where 
Q = \<t> e }(<t>e\ and 

1 

|0e) = 5>l«*>l«') (8) 

i=0 

denotes the Schmidt decomposition of \<f> e ), we have that 
the \e, f) that satisfy (e, /|W|e, /} = are given by |0)|1), 
|I)|0), and the unnormalized states 

10(A)) = (A|0> ± Vl-A 2 |l))(c lV / l-A 2 |0) T coA|l», 

(9) 

with A G (0,1). These product vectors span a three 
dimensional subspace that is orthogonal to \<f> e ). This 
means that P cannot be subtracted from W unless P = 
Q. But (I + e)W -eQ= |[(1 - e)Q + (1 + e)Q Tp ] £ 
Wf B for all e > 0. Therefore all witness operators 
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W = \{Q + Q Tp ) with Q = \<p e )(4>e\ and \<p e ) real are 
OEWf B 's. ■ 

2. Prepare& Measure (P&M) 

Once we have presented a set of witness operators that 
is optimal for the EB scheme, we will show below that 
this family is also sufficient to detect all entangled states 
that can be detected in the P&M version of the 4-state 
protocol. That is, with respect to the ability to detect 
quantum correlations, both schemes can use the same 
verification set. As we showed in Section ITTll in the case 
of P&M schemes one can add to the set of observables 
measured in the protocol other observables Cj ® 1 such 
that the observables C, form a tomographic complete set 
of Alice's Hilbert space. So we have to add the operator 
o~ y (£> (To to the observables in Eq. Q. This way one 
obtains all the witnesses that can be evaluated in the 4- 
state P&M protocol. This new set, that we shall denote 
as Wf &M , is of the form 

W 4 P&M = c v a * ® u 3 + c vo G v ® CT o ■ (10) 

i,3={0,x,z} 

where c y o is as well a real number. 

Now we present a result, Observation^] that applies to 
the observables given by Eq. J7J) and that will be useful 
to prove that the set of OEW BB obtained in Theorem 
is also sufficient to detect all entangled states that can 
be detected in the 4-state P&M scheme and, therefore, 
it forms a reduced verification set of this protocol. 

Observation 4 Given an observable W with W = 
W T = W Tp , then Tr(Wa) > for all a separable iff 
Tr(Woy) > for all a r real and separable. 

Proof: (If) Using the fact that W = W T we have 
Tt(Wct) = ±Tr[W(o- + a T )}. Note that the symmetric 
matrix a + a T is real and positive semi-definite because a 
is hermitian and positive semi-definite and transposition 
is a positive operation. Moreover (<r + a T ) Tp is positive 
semi-definite since <r Tp is positive semi-definite for all a 
separable. This means that \(o~ + a T ) is a real separa- 
ble quantum state. Therefore if Tr(Woy) > for all a r 
real and separable then Tr(VF a) > for all a separable. 
(Only if) The proof is trivial. ■ 

Theorem 3 The family of OEW EB , W = \{Q + Q Tp ) 
with Q = |0 e )(</> e | and \<p e ) a real entangled state, is suf- 
ficient to detect all entangled states that can be detected 
in the A-state P&M scheme. 

Proof: To be EWs, the operators W P&M given by 
Eq. JEJ must satisfy Tr(W 4 p&M er) > for all a sepa- 
rable. In particular, it must satisfy Tr(W^ > u r ) > 
for all o> real and separable. We have that the term 
o~ y ® do satisfies 

Tr[{<T y <g> a )a r ] = 0, V a r . (11) 



This means, therefore, that we need to guarantee that 
the first term in Eq. (|1U|) satisfies 

^2 Cij Tr[{a l ® aj)a r ] > 0, V a r . (12) 

i,3={0,x,z} 

According to Observation 0] we obtain that the term 
J2i j = {o x z} Ci 3 a i® a j m Eq. (|TU|l has to be an EW which 
belongs to the class Wf s . That is, Wf &M =Wf s + 

CyQ Oy ® (70- 

To conclude the proof, now we have to take into ac- 
count that in the 4-state P&M scheme the reduced den- 
sity matrix of Alice is fixed and given by pa = ^1. This 
means that 

Tr{W[ hM p) = Tr(Wf B p) (13) 

for all p such as Tr^(p) = ^1, since Tr[(a y Cg> o-q)p] = 0. 
That is, the entangled states that can be detected in the 
P&M protocol are also detected by the class of witnesses 
Wf B . We have, therefore, that is sufficient to consider 
the set of OEWf 8 . ■ 

3. Evaluation 

From the set of witness operators OEW|' B given by 
W = ±{Q + Q Tp ), with Q = \(f>e)((/>e\ and \<p e ) a real 
entangled state, one can obtain a necessary and suffi- 
cient condition for the presence of entanglement in the 
observable correlations P(A,B). This result applies to 
both versions of the 4-state protocol: EB and P&M. 
Note that for the case of an EB scheme all the wit- 
nesses in OEWf' 5 are optimal and form a minimal veri- 
fication set. However, for a P&M scheme some of them 
might be redundant and therefore this set of EWs forms 
a reduced verification set for this version of the proto- 
col. The set OKWf B includes an infinity number of wit- 
ness operators, but, as we will see below, these EWs can 
be easily parametrized with only three real parameters. 
From a practical point of view, this means that Alice and 
Bob can easily check the conditions Tr(W p) with W g 
OEWf B numerically. 

Let us briefly analyze the implications of our results 
in the relationship between the bit error rate e in the 
4-state and in the 6-state protocols and t he p resence of 
correlations of quantum mechanical nature [10| . Here the 
error rate e quantifies the rate of events where Alice and 
Bob obtain different results. It refers to the sifted key, 
i.e considering only those cases where the signal prepara- 
tion and detection methods employ the same polarization 
basis. In an intercept-resend attack Eve measures every 
signal emitted by Alice and prepares a new one, depend- 
ing on the result obtained, that is given to Bob. This 
action corresponds to an entanglement breaking channel 
|37j . i.e., it is a channel <I> such as / <£> $(p) is separable 
for any density matrix p on a tensor product space. Such 
a channel gives rise to e > 25% (4-state protocol) and 
e > 33% (6-state protocol), respectively 0, H3, which 
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A\B 


10) 


|1) 


1+) 


|-> 


|0> 


0.08058 


0.04757 


0.02106 


0.10709 


|1) 


0.04623 


0.07560 


0.11349 


0.00834 


1+) 


0.11808 


0.01690 


0.09319 


0.04179 


h> 


0.00873 


0.10627 


0.04136 


0.07364 



TABLE I: Example of a P(A, B) for the 4-state EB protocol, 
where |±) = l/y2(|0) ± ]1)). The table is normalized such as 
Y.iPiM.Bi) = 1. 



might seem to indicate that these values represent an 
upper bound for the tolerable error rate in the protocols 
(see also H^|). However, it turns out that for some asym- 
metric error patterns, it is possible to detect the presence 
of quantum correlations even for error rates above 25% 
(33%) |l(j- Let us illustrate this fact with two examples 
that are motivated by the propagation of the polarization 
state of a single photon in an optical fiber. 

In the first example we will consider a channel de- 
scribed by an unitary transformation that changes on 
a timescale much longer than the repetition cycle of the 
signal source, so it can be thought to be constant over 
that time: for instance, the channel given by the unitary 
transformation U(9) = cos6t — is'm8a y . In this scenario, 
the resulting distributed state for both QKD protocols is 
given by \tp) = cos0|OO) + sin0|Ol) - sin0|lO) + cos0|ll). 
The corresponding bit error rate is e = sin 2 9 and e = 
| sin 2 8 for the 4-state and the 6-state protocols, respec- 
tively. Nevertheless, it can be shown that in both cases 
the existence of quantum correlations can be detected for 
all angles 8. The case of the 6-state protocol is clear, since 
a unitary transformation preserves the entanglement and 
all entanglement can be verified in this protocol. With 
respect to the 4-state protocol, note there is always an 
entanglement witness W G OEWf B that detects quan- 
tum correlations in P(A, B). In particular, let us use 
W = i(|0 e )(0 e | + \<j) e ){(j) e \ Tp ) 1 with \4> e ) as the eigenvec- 
tor of the operator ^\tl>) (tp\ Tp which corresponds to its 
negative eigenvalue. Then we find in a suitable repre- 
sentation as a pseudo-mixture |40| for the entanglement 
witness that Tv(Wp) = J2i c » P{ a ^h) = — \- 

For the second example, we focus on the 4-state EB 
protocol only and we consider the particular joint prob- 
ability distribution P(A, B) given by Table [I] where the 
states |±> are defined as |±) = l/\/2(|0) ± |1)). In 
principle, it is not straightforward to decide whether 
these correlations can be explained as coming exclusively 
from an entangled state or not. This is specially so 
since in this case the resulting bit error rate is given 
by e w 35.4%. To decide that question systemati- 
cally we can use the verification set defined by OEWf' 5 : 
w = \{\<t>e){<i>e\ + \<l>e)(<l>e\ Tp )- The real states \cf> e ) can 
be parametrized as \<f> e ) = cos</>|00) + sin^(cos^i|01) + 
sin-!/)(cos#|10) + sin0|ll))), with only three real param- 
eters 4>,ip,8 G [0, 2ir). Moreover, since the state \<f) e ) 
is entangled these parameters satisfy additionally the 




FIG. 1: Illustration of several regimes of the parameters <p,tp, 
and 9 leading to negative expectation values of the operators 

OEWf B = §(|0e>(0e| + |0 e )<0 e f P ), With \lf> e ) = COS^OO) + 

sin <f)(cos -0 1 01) + sin ip (cos 9 | 10) + sin#]ll))), when they are 
evaluated on the joint probability distribution P(A, B) given 
in Table □ 



condition: sin (/> sin i/j (sine/) cos?/) cos # — cos</>sin0) ^ 
|4ll |. However, from a practical point of view it might 
be easier just to consider all angles 4>, tp, and 8 and 
allow the evaluation of some positive operators. Af- 
ter expressing the witness operators as a pseudo-mixture 
|4*cj the condition Tr(Wp) < can be rewritten as 
*EiM4>,il>,0) P{Ai,Bi) < 0, with Cl = fi{^,6) for 
some functions /j. Now it is easy to search numerically 
through the space of parameters </>, ip, and 8 for quan- 
tum correlations in P(A, B). This fact is illustrated in 
Figure^ where some combinations of these parameters 
detecting entanglement when they are evaluated on the 
P(A, B) given in Tableware marked. 

To finish this section we show now that the family 
of witness operators OKWf B allow to detect entangled 
states beyond those that violates Bell-like inequalities 
[30| . Note that, as we mentioned previously, the security 
of the original 4-state EB scheme Q was based on the de- 
tection of entanglement by looking at possible violations 
of Bell inequalities, which is in principle more restric- 
tive than detection of quantum correlations. It is known 
that a violation of a Bell inequality can be formally ex- 
pressed as an EW [l4| , while the contrary docs not hold 
always. An interesting question then is to ask whether 
the family of OEW^ B correspond to Bell inequalities or 
not. It is easy to see that the knowledge of the performed 
measurements in the 4-state protocol together with the 
joint probability distribution P(A, B) allow to detect en- 
tangled states that do not violate Bell-like inequalities. 
Consider for instance the two-qubit entangled states in- 
troduced by Werner in j4^| and which are defined as 



1 



Pw =p\i>-)(^-\ + -{l-p)t 



(14) 



with \ip~) = l/\/2(|01) - |10)). In the probability range 
1/3 < p < l/y/2 Werner states do not violate any known 
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Bell inequalities [43] but nevertheless they can be de- 
tected with the witnesses OEWf B for p > i. To see this, 
note that the operator fl = l/4(pw 
is a non-positive operator for p > ^ . 



and 



P T w A 



Pw + Pw) 



C. 2-state protocol 

The 2-state protocol ^(| is one of the simplest QKD 
protocols, since it is based on the random transmission 
of only two nonorthogonal states, |t^ ) and Alice 
chooses randomly a bit value i, and prepares a qubit in 
the state \ip t ) = a\0) + (-1)7?|1), with < a < l/s/2 
and f3 = \/l — a 2 , that is sent it to Bob. On the re- 
ceiving side, Bob measures the qubit he receives in a ba- 
sis chosen, independently and at random, within the set 
{{\<Po)Ari)},{\<Pi),\<fit)}}, with |(^|^)| = 0. Note 
that alternatively to this detection method, Bob could 
also perform a POVM defined by the operators Fq = 
\f>i}((pi\/2, Ft = |^)(^i/2, and F null = t - Fq- Fi. 
Using the ideas introduced by Bennett et al. one 
can also think of the preparation process in the following 
way: Alice prepares an entangled bi-partite state of the 
form 



i 



AB 



V2 



(|0)a|vo)b + |1)a|vi)b), 



(15) 



and then she measures her subsystem in the basis 
{|0),|1)}. Note that in this scheme the fact that the 
reduced density matrix of Alice is fixed and equal to 
p A = Tr B (\^)(^\ AB ) with \V) AB given by Eq. JTSJ is 
vital to detect quantum correlations in P(A,B). Oth- 
erwise, the joint probability distribution P(A, B) alone 
does not allow Alice and Bob to distinguish between 
the entangled state I^ab and the separable one a AB = 

|Ei=o N)( ? 'U ® \fi)(<fi\- 

We obtain, therefore, that the set of EWs that can 
be evaluated in the 2-state protocol, and which we shall 
denote as W2, is of the form 

W 2 = ^2 (Hj <Ji ®aj+ ^2 c k °k ® cro, (16) 

k={Q,x,z,y} 

i={0,z} 
j={x.z] 

where the second term in Eq. I|16|) includes a set of ob- 
servables such as Alice can reconstruct completely the 
state of her subsystem. This family of witness operators 
can equivalently be rewritten as 

W 2 = \0}(0\®A+\l}(l\®B + xC(6), (17) 

where A and B represent two real symmetric operators, 
A = A T and B = B T , given by 



A = ^2 ( c at + c zl ) Oi 

i={0,x,z} 



(18) 



B = ^2 ( C « - C zi) °i 
i—{0,x,z} 



(19) 



respectively, the parameter x is given by x = \c x + ic y \ > 
0, and 



C(0) = 






e ie a 


e' tf> a 






(20) 



with 9 = tan - (c y /c x ). That is, we have included the two 
observables a x ® \ and a y ®\ that appear in Eq. i|16|) 
in the term x C(6) of Eq. (|17|) . while the remaining ob- 
servables in Eq. (|16|) are included in the first two terms, 
|0)(0| ® A+ |1) (1| ®B, of Eq. C7J. 

It is straightforward to see that, as in the case of the 
4-state (EB and P&M) protocol, the class of witness op- 
erators W2 does not allow to evaluate the OEW given 
in Eq. ©. Note that the elements W in OEW sat- 
isfy W ^ and W Tp > 0. The witnesses in the class 
W2 , on the contrary, fulfill W2 = W2 13 , which means 
that W^ B cannot be a positive semi-definite operator 
unless W2 is also positive semi-definite. Therefore, in 
the 2-state protocol there can be also entangled states 
that give rise to correlations P(A, B) that are not suf- 
ficient to prove the presence of entanglement. In the 
same way, it is interesting to note also that there are no 
witnesses in the set of W2 that belongs to the family of 
OEWf B = ±(|</> e )(0 e | + |0 e )(0 e | Tp ). To see this, note 
that the representation given in Eq. I|17|) is incompatible 
with the fact that the state \<fi e ) is a real entangled state. 
In the rest of this section we obtain a reduced verification 
set of the 2-state protocol (Theorem . 

The first requirement that an operator of the form 
given by Eq. fT7|l must satisfy to be an EW is Tr(W 2 cr) > 
for all separable states a. Since the set of separa- 
ble states is convex, this condition is equivalent to ask 
Tr(W 2 \(f>){<t>\ A ® K'XV'Ib) > for all states \<t>) A \ip) B . 
Let us start by considering states of the form |0)a|^)b- 
We have that Tr(W 2 \0)(0\ A ®\ip)(ip\ B ) = (ip\A\i/j), which 
means that the operator A must be positive semi-definite, 
i.e., A > 0. In the same way, but now using the sepa- 
rable pure states |1) j 4|'0)-Bj one obtains B > 0. This 
means that the first two terms of Eq. l(T7|) . |0)(0| ® A + 
|l)(l|(g>-B, represent a positive semi-definite operator and 
the only term responsable to detect quantum correla- 
tions is the one given by x C(6). Note that this im- 
plies that the class W 2 does not allow to detect maxi- 
mally entangled states \<j> e ) = l/V^X^o IV^IVi); with 
(ipilipj) = (fil^j) = <%i since in that case it turns out 
that {(p e \C(9)\<f) e ) = 0. This fact is not too surprising 
since the distributed states in this protocol are not max- 
imally entangled. Let us now come back to the general 
case: Tr(W 2 \(j>){4>\ A <8> \4>)(ip\ B ) > 0. If we express the 
state \4>) A as \(j>) A = a\0) + /3|1), this condition reduces 
to 



2\a/3\x < (ip\{\a\ 2 A- 



l B)\i>), V|^) 



(21) 
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and for all a and /? such that \a\ 2 + |/3| 2 = 1. After 
optimizing over the parameters a and /?, Eq. I|21|) can be 
further simplified to 

x < mm w (22) 

That is, whenever the value of the parameter x is below 
the bound given by Eq. I|22|l. W2 has a positive expecta- 
tion value on all separable states. 

Now we will provide a necessary and sufficient condi- 
tion for the operators W2 in order to detect entangle- 
ment, i.e, to guarantee W2 ^ 0. First, it is straightfor- 
ward to see that the operators A and B have to be of full 
rank, otherwise according to Eq. [1221) we have x = and 
W 2 = |0)(0| <g> A+ |1)(1| ®B > 0. Now we can prove the 
following observation: 

Observation 5 An operator W 2 = |0)(0| ® A + |1)(1| ® 
B + x C(9), with A and B being two real symmetric pos- 
itive operators, A > and B > 0, and the operator C{9) 
given by Eq. fifty) with 6 G [0, 2ir) satisfies W 2 ^ iff 



x mtn = ^--yj—-det(A)det(B), (23) 

and where a = Tr(AB). 
Proof: See Appendix lAl 

Theorem 4 TTie family of witness operators W2 = 
|0)(0| <g> A + |1)(1| <g) B + x C(0), w^ft A and S 6em 5 
too reaZ symmetric positive operators, A > and _B > 0, 
t/ie operator C(9) given by Eq. ^2Uj) with 9 G [0, 2tt), and 
such as x = minify/ (ip\A\ip) (il>\B\ip) > x m i n is suffi- 
cient to detect all entangled states that can be detected in 
the 2- state protocol. 

Proof: According to the results presented above, we only 
need to prove that given a witness operator W2 ^ with 
a value of x that saturates the bound of Eq. (|22|l . and 
that we shall denote as W2(x rnax ) , is finer than the same 
witness W2(x) with an x < x max . That is, 

Tr[W 2 {x max )p] < Tr[W 2 (x)p] (24) 

for all p entangled and detected by W2(x). Since 
W2{x max ) and W2{x) share the same operators A and 
B by definition, Eq. I|24|l can be further simplify to 

(xmax ~ x) Tr[C(9)p] < 0. (25) 

Finally note that this condition is always fulfilled, since 
{xmax — x) > and Tr[C(9)p] < 0, otherwise p cannot 
be detected by W2(x). ■ 

The coefficients of the pseudo-mixture decomposition 
of the witness operators given by Theorem 0] can be 
parametrized in this case with six real parameters. 



D. Higher dimensional QKD protocols 

So far we have searched for quantum correlations in 
qubit-bascd QKD protocols which means we have re- 
stricted ourselves to operators in C 2 (g> C 2 . This fact 
makes the characterization of a given class of witness op- 
erators easier, since for systems defined in H = C 2 (g> C 2 
and H = C 2 (g) C 3 all witness operators belong to the 
class of so-called decomposable entanglement witnesses 
(DEWs) which has a simple well-known form: W = 
eP + (1 - e)Q Tp , with P > and Q > satisfying 
Tr(P) = Tr(Q) = 1, and e G [0, 1) 44]. In the case of 
systems of higher dimension than those in H = C 2 <%> C 2 
and H = C 2 <£> C 3 not all the witness operators are 
DEWsjfor example DEWs cannot detect PPT entangled 
states |23| ■ It is necessary to use also the so-called non- 
decomposable entanglement witnesses (NDEWs). This 
fact makes the characterization of witness operators more 
subtle and so far it is still not clear how to construct 
such witness operators even when the information about 
the state is tomographic complete 0, 0, ^|J. As we 
mentioned already before, ideally the goal is to obtain 
a compact description of the minimal verification set for 
a given QKD protocol in order to systematically search 
for entanglement in P(A, B). However, due to the fact 
that the characterization of NDEWs is not easy to handle 
it might be of interest to obtain, at least, one relevant 
EW within the proper class as a first step towards the 
demonstration of successful QKD. 

Recently, it has been shown that a good deal of new 
insight in the optimization of NDEWs can come from 
the theory of convex optimization 0, l46l |47| . More 
important for QKD, the problem of the minimization of 
expectation values of witness operators W with respect 
to pure product states, 

min Tr(W |o, 6)(a, 6|), (26) 

\a,b) 

can also be formulated as a convex optimization problem 
[13 ■ Solving Eq. allows to obtain new witness op- 
erators which are finer than W , even within a restricted 
class W c of them |T3| - To see this, let W G We and de- 
note the result of the minimization problem in Eq. I|2t)|) 
as e = mhi| ^ Tr[\a, b)(a, b\ W] > 0. Then the unnor- 
malized new witness operator given by W = W — el is 
finer than W and moreover it is guarantee that W G Wc 
since the observable 1 is always accessible. At first sight 
it seems that this procedure requires to have already a 
valid entanglement witness W for the given QKD pro- 
tocol. However, this operator does not need to be an 
entanglement witness in the strict sense, but can be 
also a positive operator from the restricted set which 
is more easy to characterize than an entanglement wit- 
nesses (l^. With respect to the minimization problem 
itself, it has been shown that although the polynomial 
constraints parametrizing the pure states \a,b) are non- 
convex and computationally expensive to handle, one can 
apply results from relaxation theory of non-convex prob- 
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lems notably the method of Lasserre [^J, to 

find hierarchies of solutions to that problem in a way 
that each step of the hierarchy is a better approxima- 
tion than the previous one ^3] ■ Each step itself amounts 
to sol ving an efficiently implementable semi-definite pro- 
gram |5l| and the hierarchy is asymptotically complete, 
in the sense that the exact solution is asympotically at- 
tained. This means that during several steps of the op- 
timization method, better witness operators W can be 
obtained from W, belonging to the same restricted class 
W e . 

Finally, let us mention that, of course, not all higher 
dimensional QKD protocols require the use of NDEWs to 
derive a necessary and sufficient condition for the pres- 
ence of entanglement in P(A,B). For instance, consider 
the class of EB protocols in H = C 2 <£> , where Alice 
realizes projection measurements onto the eigenvectors 
of the two Pauli operators a x and a z . In all these EB 
protocols the accessible witness operators satisfy the con- 
dition W = W Ta . One can show that this fact implies 
for the given dimensionalities that it is a necessary condi- 
tion for a state p to be detected by W that the operator 
Q = h(p + P Ta ) is a non-positive operator. To prove this, 
note that Tr(Wp) = Tr(Wfl). From the work by Kraus 
et al. [54| we learn that whenever SI is a non-negative op- 
erator it represents a separable state. To summarize this 
remark, we learn that all detectable states for this class 
of protocols are negative partial transposed (NPT) en- 
tangled states and can be detected by using only DEWs. 
The situation changes once Alice performs also a projec- 
tion measurement onto the eigenvectors of o~ y . 



E. Outlook to practical QKD systems 

The idea to check for quantum correlations in the ob- 
served data with the help of a verification set of witnesses 
applies also, in principle, to real implementations of QKD 
setups j52j . One can incorporate any imperfection of the 
sources and the detection devices into the corresponding 
investigation within the framework of trusted devices. In 
that framework one characterizes detection devices by 
the use of an appropriate POVM description, e.g. on the 
infinite dimensional Hilbert space of optical modes. For 
P&M schemes, one has to characterize additionally the 
given source via the reduced density matrix of the vir- 
tual internal preparation state, as described before. This 
idea then needs to be generalized to signal states that 
arc described by mixed quantum states. For this pur- 
pose, one uses still a pure state as internal preparation, 
but Alice's signal preparation corresponds now no longer 
to a projection onto an orthogonal set of pure states, but 
to projections onto orthogonal subspaces, thereby effec- 
tively preparing mixed states. 

In those general scenarios, it will be difficult to provide 
the minimal verification set of witnesses. Instead, one can 
fall back to the approach to search for just one accessible 
witness via numerical methods such as presented in the 



previous section. In this way, one can search through 
restricted classes of accessible witnesses at the price that 
the result of this search will not be conclusive, i.e. this 
search yields only a sufficient condition. 



V. CONCLUSION 

A necessary precondition for secure quantum key dis- 
tribution (QKD) is that sender and receiver can use their 
available measurement results to prove the presence of 
entanglement in a quantum state that is effectively dis- 
tributed between them. Moreover, this result applies 
both to prepare&measure (P&M) and entanglement based 
(EB) schemes. This means that to construct practical 
and efficient new QKD protocols, it is vital to separate 
the generation of two-party correlations from the pub- 
lic discussion protocol which extracts a key from those 
data. Among all separability criteria to deliver this neces- 
sary entanglement proof, entanglement witnesses (EWs) 
are specially appropriate since from them one can derive 
a necessary and sufficient condition for the existence of 
quantum correlations even when the state shared by the 
users cannot be completely reconstructed. 

In a recent work |l0| . the set of optimal witness op- 
erators for two well-known EB schemes: the 6-state and 
the 4-statc EB protocols, was obtained and a necessary 
and sufficient condition to detect entanglement in both 
protocols was derived. The purpose of this paper was to 
complete these results, now showing specifically the anal- 
ysis for the case of P&M schemes where, contrary to the 
case of EB schemes, now the reduced density matrix of 
the sender is fixed and cannot be modified by the eaves- 
dropper. In particular, we have investigated the signal 
states and detection methods of the 4-state and the 2- 
state P&M schemes, and we have obtained a reduced set 
of EWs that can be used to provide a necessary and suffi- 
cient condition for the existence of quantum correlations 
in both protocols. 

Finally, we have discussed very briefly how to de- 
tect quantum correlations in higher dimensional QKD 
schemes and in practical QKD, where the characteri- 
zation of EWs is not as easy to handle as in the case 
of qubit-based QKD schemes. In this scenario it might 
be still of interest to obtain one relevant EW as a first 
step towards the demonstration of successful QKD. Here, 
mathematical results from the field of convex optimiza- 
tion theory can be used to get new insights in the con- 
struction of finer EWs within a given class. 
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APPENDIX A: CONDITION FOR W 2 £ 

In this appendix we provide a proof for Observation 
|SJ Our starting point is the most general form of the 
operators W 2 = [0> <0| 0^4+ 11}(1| ®B + x C{9). That is, 
if we write the matrix element of W% explicitly we have 



Wo 



xe 

V o 



aid 



AO 



xe 

xe 

e g 

9 f ) 



(Al) 



Now we have to understand what the condition W% > 
imposes on the elements of W2 ■ We have by definition of 
the class W2' A > and B > or, since A and B are of 
full rank, we can assume at this point A > and B > 0. 
Under this assumption, we can use the well known fact 
that such a block matrix as in Eq. (IA1|) is positive iff its 
Schur complement is positive [5^ | , which implies here 

A-x 2 B~ 1 >0. (A2) 

Introducing the notation y = x 2 /det(B) the 2x2 matrix 



X = 




> 



(A3) 



has to be positive. This is the case, iff det(X) > and 
Tr(X) > 0. After a short calculation, this implies that 



ab- c 2 - (ae + bf + 2cg)y + (ef 
(a + b)-y(e + f)>0. 



g 2 )y 2 > 0, (A4) 
(A5) 



When are these inequalities fulfilled for different values 
of y > 0? For y = the matrix X is clearly positive. 
If y increases X get first one negative eigenvalue. Thus 
Eq. l|A4j) is violated, while Eq. (|A5|) is still valid. If y 
increases further, the eigenvalues decrease and Eq. (|A5|) 
gets violated. Finally, X gets two negative eigenvalues, 
and Eq. ljA4() is valid, while Eq. (|A5|> is still violated. So 
we have to look for the smallest zero of Eq. l|A4jl which 
is given by 



a a 2 det(A) 

2det(B) ~ V Adet{B) 2 ~ det(B) ' 



(A6) 



where we have used a = Tr(AB) = (ae + bf + 2cg). We 
obtain, therefore, that W2 is positive iff 



(A7) 



with 



— -det(A)det{B). (A8) 
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